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We present a setup for quantum secret sharing using 
pseudo-GHZ states based on energy-time entanglement. In 
opposition to true GHZ states, our states do not enable GHZ- 
type tests of nonlocality, however, they bare the same quan- 
tum correlations. The relatively high coincidence count rates 
found in our setup enable for the first time an application of 
a quantum communication protocoll based on more than two 
qubits. 

PACS Nos. 3.67.Hk, 3.67.Dd 

Entangled particles play the major role both as candi- 
dates for tests of fundamental physics Jl|-^| as well as in 
the whole field of quantum communication Q . Until re- 
cently, most work has been focussed on two-particle cor- 
relations. Since a couple of years, however, the interest 
in multi-particle entanglement - which we identify in this 
article with n>2 - is growing rapidly. From the funda- 
mental side, particles in so-called GHZ states enable new 
tests of nonlocality || . From the side of quantum com- 
munication, more and more ideas for applications, like 
quantum secret sharing emerge. A major problem 
still is the lack of multi-photon sources. Nonlinear effects 
that enable to " split" a pump photon into more than two 
entangled photons are extremely low efficient, and exper- 
iments still lie in the future. Recently Bouwmeester et 
al. could demonstrate a different approach where they 
started with two pairs of entangled photons and trans- 
formed them via a clever measurement into three pho- 
tons in a GHZ state and a fourth independant trigger 
photon |J. In this letter we present another method 
to create what we term pseudo-GHZ states. It is based 
on a recently developed novel source for quantum com- 
munication, creating entangled photons in energy-time 
Bell-states ]lO| , pd| . In opposition to "true" GHZ states, 
the three photons being in the pseudo-GHZ state do not 
consist of three downconverted photons but only of two 
downconverted ones plus the pump photon. We will com- 
ment on similarities and differences compared to true 
GHZ states and demonstrate a first application of our 
states for quantum secret sharing. In this case, the dif- 
ference to true GHZ states is not only of no importance, 
but enables for the first time to realize a multi-particle 
application of quantum communication. 

Entangled states of more than two qubits, so-called 
GHZ states, can be described in the form 



(1) 



where | ) and | 1 ) arc orthogonal states in an arbi- 
trary Hilbert space and the indices label the particles (in 
this case three). As shown by Greenberger, Home and 



Zeilinger in 1989 ||, the attempt to find a local model 
able to reproduce the quantum correlations faces an in- 
consistency. In the multi-particle case, the contradiction 
occurs already when trying to describe the perfect corre- 
lations. Thus, demonstrating these correlations directly 
shows that nature can not be described by local theo- 
ries. However, since it will never be possible to experi- 
mentally demonstrate perfect correlations, the question 
arises whether there is some kind of threshold, similar to 
the one given by Bell inequalities for two-particle corre- 
lations [Q , that enables to seperate the " non- local" from 
the "local" region. Indeed, the generalized Bell inequal- 
ity for the three-particle case jl2[ 
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with E(a,/3,7) the expectation value for a correlation 
measurement with analyzer settings a,/3, 7 can be vio- 
lated by quantum mechanics, the maximal value being 
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For instance, finding a correlation function of the form 
E(a,{3,-f) = Vcos(a + (3 + 7) with visibility V above 
50% shows that the correlations under test can not be 
described by a local theory. Note that this value is much 
lower than in the two-particle case where the threshold 
visibility is « 71 %. 



Quantum secret sharing |7|8J is an expansion of the 
" traditional" quantum key distribution to more than two 
parties. In this new application of quantum communica- 
tion, a sender, usually called Alice, distributes a secret 
key to two other parties, Bob and Charly, in a way that 
neither Bob nor Charly alone have any information about 
the key, but that together they have full information. 
Moreover, an eavesdropper trying to get some informa- 
tion about the key creates errors in the transmission data 
and thus reveals his presence. The motivation for secret 
sharing is to guarantee that Bob and Charly must coop- 
erate - one of them might be dishonest - in order to do 
some task, one might think for instance of accessing clas- 
sified information. As pointed out by Hillery et al. 0, 
this protocol can be realized using GHZ states. Assume 
three photons in a GHZ state of the form (|l|) with | ) 
and 1 1) being different modes of the particles (Fig. 1). 
After combining the modes at beamsplitters located at 
Alice's, Bob's and Charly's, respectively, the probability 
to find the three photons in any combination of outputs 
ports depends on the settings a, [3, 7 of the phase shifters: 
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with k — ±1 labeling the different output ports. Be- 
fore every measurement, Alice chooses randomly one out 
of two phase values (0, ir/2), Bob applies a phase shift of 
either — ir/2 or 0, and Charly chooses between tt/2 and 
37r/2. After a sufficient number of runs, they publicly 
identify the cases where all detected a photon. All three 
then announce the phases chosen and single out the cases 
where the sum adds up either to or to it. Note that 
the probability function (Eq. ||) yields 1 for these cases. 
Denoting l=cos(a / +/3+7)=±l and using Pi t j t k=l, Eq. [| 
leads to 



ijkl = 1. 



(5) 



At this point, each of them knows two out of the values 
i,j,k,l. If now Bob and Charly get together and join 
their knowledge, they know three of the four parameters 
and can thus determine the last one, which is also known 
to Alice. Identifying with bitvalue "0" and 

with "1", the correlated sequences of parameter values 
can then be turned into a secret key. Note that this 
scheme is completely symmetric. Any of the three can 
force the two other to collaborate in order to get infor- 
mation about his key, which in turn enables to read his 
confidential message. Like in two-party quantum cryp- 
tography, the security of quantum secret sharing using 
GHZ states is given by the fact that the measurements 
are made in noncommuting bases HHHl. An eavesdrop- 
per, including a dishonest Alice, Bob or Charly, is thus 
forced to guess about the bases that will be chosen. The 
fact that she will guess wrong in half of the cases then 
leads to detectable errors in the transmission data which 
reveal her presence. 
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FIG. 1. Schematics for quantum secret sharing using GHZ 
states. 
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FIG. 2. Principle setup for quantum secret sharing using 
energy-time entangled pseudo-GHZ states. Here shown is a 
fiberoptical realization. 

We now explain how to implement secret sharing us- 
ing our source (see Fig. 2). A short light pulse emitted 
at time to enters an interferometer having a path length 
difference which is large compared to the duration of the 
pulse. The pulse is thus split into two pulses of smaller 
amplitude, following each other with a fixed phase rela- 
tion. The light is then focussed into a nonlinear crystal 
where some of the pump photons arc downconverted into 
photon pairs. The pump energy is assumed to be such 
that the possibility to create more than one pair from 
one initial pump pulse can be neglected. This first part 
of the setup is located at Alice's. The downconverted 
photons are then separated and send to Bob and Charly, 
respectively. Both of them are in possession of a simi- 
lar interferometer as Alice, introducing exactly the same 
difference of travel times. We assume the transmission 
probabilities via the different arms of any of the three 
interferometers to be alike. The two possibilities for the 
photons to pass through any device lead to three time dif- 
ferences between emission of the pump pulse at Alice's 
and detection of signal or idler photon, as well as between 
the detection of one downconverted photon at Bob's and 
the correlated one at Charly's (Fig. 2). Looking for ex- 
ample at the possible time differences between detection 
at Bob's and emission of the pump pulse (ts — t ), we 
find three different terms. The first one is due to "pump 
pulse travelled via the short arm and Bob's photon trav- 
elled via the short arm" to which we refer as \s)a',\s)b- 
Please note that this notation considers the pump pulse 
as being a single photon (now termed "Alice's photon"), 
stressing the fact that only one pump photon is anihilatcd 
to create one photon pair. Moreover, the fact that this 
state is not a product state is taken into account by sep- 
arating the two kets by " ;" . The second time difference is 
either due to \s)a',\1)b, or to \1)a',\ s )b, and the third 
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one to 1 1) a', 1 1 )b- Similar time spectra arise when look- 
ing at the time differences between emission at Alice's 
and detection at Charly's (tc — t ), as well as between 
the detections at Bob's and Charly's {tc — ts)- Selecting 
now only processes, leading to the central peaks Jl4|], we 
find two possibilities: Either Alice's photon traveled via 
the long arm and Bob's as well as Charly's took the short 
ones, or Alice's photon choose the short arm and Bob's 
and Charly's both the long ones. If both possibilities are 
indistinguishable, the process is described by 

\^) = ^l) A -\ s ) B \ s ) c + e^ + ^\s) A -\l) B \l)c^ 

(6) 

with phases a,/3,7 in the different interferometers. The 
maximally entangled state (^|) is similar to the GHZ state 
given in Eqjl], the difference being that the three photons 
do not exist at the same time (remember the ";"). There- 
fore, our state is obviously of no significance concerning 
GHZ-type tests of nonlocality. To stress this difference, 
we call it pseudo-GHZ state. However, the probability- 
function describing the triple coincidences (Eq.^) - in our 
case between emission of a pump pulse and detection at 
Bob's and Charly's - is the same as the one originating 
from a true GHZ state. To avoid the complication of 
switching the pump laser randomly between one of the 
two input ports - equivalent to detecting a photon in one 
or the other output port -, we let Alice chose between one 
of four phase values a' (0,7r/2,7r,37r/2). To map the choice 
of phases to the initial scheme where the information of 
Alice, Bob and Charly is given by a phase setting and a 
detector label, we assign a different notation to character- 
ize Alice phases (table 1). Using this convention, we can 
implement the same protocol as given above, the advan- 
tage being the fact that our setup circumvents creation 
and coincidence detection of photon triples. The emission 
of the bright pump pulse can be considered as detection of 
a photon with 100 % efficiency. Moreover, no low efficient 
triple photon generation is necessary. This leads to much 
higher triple coincidence rates, enabling the demonstra- 
tion of a multi-photon applications of quantum commu- 
nication. One might question the security of our setup, 
the weak point being the channel leading from Alice's 
interferometer to the crystal. Here, the light is classical 
and the phase could be measured without modifying the 
system. However, since this part is controlled by Alice 
and the parts, physically accessible to an eavesdropper 
carry only quantum systems, our realization does not in- 
corporates any loophole. 

The experimental setup is described in jljj] , where it 
is used to demonstrate two-party quantum key distribu- 
tion using energy-time Bell states. We will thus give only 
a brief outline. To generate the short pump pulses, we 
use a pulsed diode laser (PicoQuant PDL 800), emitting 
600ps (FWHM) pulses of 655 nm wavelength at a repeti- 
tion frequency of 80 MHz. The light is channeled through 
a fibcroptical Michelson interferometer (path length dif- 



ference corresponding to 1.2 ns travel time difference) 
and focussed into a 4x3x12 mm KNbO^ crystal, produc- 
ing photon pairs at 1310 nm wavelength. The average 
power before the crystal is sa 1 mW, and the energy per 
pulse - remember that each initial pump pulse is now 
split into two - ~ 6 pJ. After absorption of the red pump 
light, the downconverted photons are separated and are 
guided to fiberoptical Michelson interferometers, located 
at Bob's and Charly's, respectively. To access the second 
output port, usually coinciding with the input port for 
this kind of interferometer, we implement 3-port optical 
circulators. The interferometers incorporate equal path 
length differences, and the travel time difference is the 
same than the one introduced by the interferometer act- 
ing on the pump pulse. The output ports are connected 
to single-photon counters - passively quenched germa- 
nium avalanche photodiodes, operated in Geiger-mode 
and cooled to 77 K. We operate them at dark count rates 
of 30 kHz, leading to quantum efficiencies of w 5 % and 
single photon detection rates of 4-7 kHz. The electrical 
output from each detector is fed into a fast AND-gate, 
together with a signal, coincident with the emission of 
a pump pulse. We condition the detection at Bob's and 
Charly's on the central peaks (\s)p;\1)a and \1)p;\s)a, 
and \ s)p;\1)b and 1 1 )p ; | s)b, respectively). Looking at 
coincident detections between two AND-gates - equiva- 
lent to triple coincidences -, we finally select only the 
interfering processes for detection. 
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FIG. 3. Result of the measurement when changing the 
phase in Alice interferometer. The different mean values are 
due to non-equal quantum efficiencies of the single photon 
detectors. The values for the case i—'-l" have been found 
corresponding to table I. For global phase zero, we find a 
mean QBER of (3.9±0.4)%. If Bob and Charly both detect a 
photon in the "+"-labeled detectors in this case (l=+l), they 
know that Alice value i must be +1 as well. 

Since the stability of our interferometers is not suf- 
ficient to maintain stable phases over a long time, we 
demonstrate that our source can be used for quantum 
secret sharing by continuously changing the phases in 
Alice's as well as in Bob's interferometer. We observe si- 
nusoidal fringes in the triple coincidence rates with max- 
imum count rates around 1600 in 100 sec and minimum 
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ones around 70 (see Fig. 3). Visibilities are inbetween 
89.3 and 94.5% for the different detector combinations, 
leading to a mean visibility of 92.2±0.8% and a quantum 
bit error rate BER - the ratio of errors to detected events 
- of (3.9±0.4)%. The critical visibility above which the 
information that might have been obtained by an eaves- 
dropper can be made arbitrarily small using classical er- 
ror correction and privacy amplification is not known 
yet. In case of two-party quantum key distribution, it 
corresponds exactly to a violation of two-particle Bell in- 
equalities |b| . It is thus reasonable to compare the mean 
visibilitiy to the value given by generalized Bell inequal- 
ity (Eq.^), even if our setup does not incorporate GHZ- 
type nonlocality: The found visibility of 92.2±0.8% is 
more than 50 standard deviations (<r) higher than the the 
threshold visibility for the three-particle case. Moreover, 
it is more than 25 a above 71%, the value given by stan- 
dard (two-particle) Bell inequalities. Within this respect, 
it is also interesting to calculate S exp : We find S exp =3.69, 
well above =2 (Eq||). Therefore, the performance of 
our source is good enough to detect any eavesdropping 
and to ensure secure key distribution. Moreover, the bit- 
rate of ~ 16 Hz underlines its potential for real applica- 
tions. To compare our coincidence rate to an experiment 
using true GHZ states |)| , Bouwmeester et al. found one 
GHZ-state per 150 sec. However, in order to really im- 
plement our setup for quantum secret sharing, an active 
phase stabilization and a fast switch still have to be in- 
corporated 

Like in all experimental quantum key distribution, the 
QBER is non-zero, even in the absence of any eavesdrop- 
ping. The observed 4% can be traced back to wrong 
counts from accidentally correlated event at the single- 
photon counters, non-perfect localization of the pump 
pulse, limited resolution of the single-photon detectors 
and non-perfect interference. Note that the number of 
errors due to the last mentioned points decrease with 
distance (caused by higher transmission losses) and thus 
do not engender an increase of the QBER. In opposi- 
tion, the number of errors due to accidental coincidences 
stays almost constant since it is mostly due to detector 
noise. However, it causes only 10% of the total errors 
in our laboratory demonstration. Therefore, the QBER 
will increase only at a small rate, enabling quantum se- 
cret sharing over tens of kilometers. 

In conclusion, we demonstrated quantum secret shar- 
ing using energy-time entangled pseudo-GHZ states in 
a laboratory experiment. We found bit-rates of around 
16 Hz and quantum bit error rates of 4%, low enough 
to ensure secure key distribution. The advantage of our 
scheme is the fact that neither triple-photon generation 
nor coincidence detection of three photons is necessary, 
enabling for the first time an application of a multi- 
particle quantum communication protocol. Moreover, 
since energy time entanglement can be preserved over 
long distances q], our results are very encouraging for 
realizations of quantum secret sharing over tens of kilo- 
meters. 
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TABLE I. Mapping of the four possible phases a' at Alice's 
to two phase values a and the parameter i. 
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